hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-15 05:23:40 +00:00
Code Issues Projects Releases Wiki Activity
xserver/Xext/xinput
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer cede1a7f95 Xi: validate modifier values in ProcXIPassiveUngrabDevice 
ProcXIPassiveUngrabDevice() passes client-supplied modifier values
directly to DeletePassiveGrabFromList() without validating them.

DeletePassiveGrabFromList() may reach DeleteDetailFromMask() which uses
BITCLEAR(mask, modifier). The mask is allocated as 8 Mask words (256
bits). A modifier value > 255 causes BITCLEAR to index mask[modifier>>5]
past the allocation, resulting in a controlled single-bit-clear at an
attacker-chosen heap offset.

Add the same modifier validation that CheckGrabValues() uses: reject
modifiers that are not XIAnyModifier and have bits set outside
AllModifiersMask.

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-32366

CVE-2026-93523

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit 37a1847a60)
2026-10-20 21:11:11 +02:00
..
allowev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgdctl.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgfctl.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgkbd.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgkmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgprop.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgptr.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
chgptr.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
closedev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
devbell.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
exevents.c Xi: Guard against NULL event pointer 2026-08-31 14:47:14 +02:00
exglobals.h Xi: turn XIAllMasks from variable into #define 2026-06-29 14:30:53 +02:00
extinit.c Xi: byte-swap DeviceChanged valuator and scroll data 2026-10-01 19:00:26 +02:00
getbmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getdctl.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getfctl.c Xi: zero feedback reply buffer in ProcXGetFeedbackControl 2026-06-23 17:28:08 +02:00
getfocus.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getkmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getmmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getprop.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getprop.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getselev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
getvers.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
grabdev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
grabdev.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
grabdevb.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
grabdevk.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
gtmotion.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
handlers.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
listdev.c xext: xinput: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:25:28 +02:00
meson.build Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
opendev.c Xi: parentheses around macro argument symbols 2026-06-25 07:31:44 +02:00
queryst.c Xi: fix NULL pointer dereference in ProcXQueryDeviceState 2026-06-23 17:28:42 +02:00
selectev.c Xi: turn XIAllMasks from variable into #define 2026-06-29 14:30:53 +02:00
sendexev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setbmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setdval.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setfocus.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setmmap.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
setmode.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
stubs.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
ungrdev.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
ungrdevb.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
ungrdevk.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xiallowev.c xext: xinput: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:25:28 +02:00
xibarriers.c xinput: make barrier event emission NULL-safe in input_constrain_cursor() 2026-10-07 15:56:14 +02:00
xibarriers.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xichangecursor.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xichangehierarchy.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xichangehierarchy.h treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xigetclientpointer.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xigrabdev.c treewide: replace min/max macros by non-exported MIN/MAX and deprecate them 2026-06-25 14:06:17 +02:00
xipassivegrab.c Xi: validate modifier values in ProcXIPassiveUngrabDevice 2026-10-20 21:11:11 +02:00
xiproperty.c xext: xinput: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:25:28 +02:00
xiproperty.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xiquerydevice.c Xi: byte-swap XIQueryDevice ScrollClass flags 2026-10-01 18:55:18 +02:00
xiquerydevice.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xiquerypointer.c xext: xinput: use stdbool's 'bool' instead of 'Bool' for local variables 2026-08-07 14:25:28 +02:00
xiqueryversion.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xiselectev.c Xi: xiselectev: fix OOB read in ProcXISelectEvents' non-swapped path 2026-07-03 19:59:53 +02:00
xisetclientpointer.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xisetdevfocus.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
XIstubs.h Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
xiwarppointer.c dix, Xi: remove spurious dereference when checking function pointers 2026-10-15 16:47:45 +02:00